DEBIAN-CVE-2024-50143

In the Linux kernel, the following vulnerability has been resolved: udf: fix uninit-value use in udfgetfileshortad Check for overflow when computing alen in udfcurrentaext to mitigate later uninit-value use in udfgetfileshortad KMSAN bug1. After applying the patch reproducer did not trigger any...

SUSE CVE-2024-49506

Insecure creation of temporary files allows local users on systems with non-default configurations to cause denial of service or set the encryption key for a filesystem...

The vulnerability of the fs/ntfs3 component in the Linux operating system, related to pointer arithmetic errors, allows a hacker to trigger a service failure.

The vulnerability of the fs/ntfs3 component in the Linux operating system is related to pointer swapping errors. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the ocfs2_xattr_find_entry() function in the ocfs2 file system of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the ocfs2xattrfindentry function in the fs/ocfs2/xattr.c file of the Linux operating system’s file system ocfs2 is related to memory allocation beyond the bounds of the allocated buffer. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...

The vulnerability of the nilfs_btree_check_delete() function in the file system of the nilfs2 driver in the Linux operating system allows a attacker to compromise the confidentiality and accessibility of the protected information.

The vulnerability of the nilfsbtreecheckdelete function in the fs/nilfs2/btree.c file of the Linux operating system’s kernel involves accessing memory beyond the allocated buffer. Exploiting this vulnerability could allow an attacker to compromise the confidentiality and accessibility of the...

GHSA-HXF5-99XG-86HW cap-std doesn't fully sandbox all the Windows device filenames

Impact cap-std's filesystem sandbox implementation on Windows blocks access to special device filenames such as "COM1", "COM2", "LPT0", "LPT1", and so on, however it did not block access to the special device filenames which use superscript digits, such as "COM¹", "COM²", "LPT⁰", "LPT¹", and so o...

CVE-2024-51756

The cap-std project is organized around the eponymous cap-std crate, and develops libraries to make it easy to write capability-based code. cap-std's filesystem sandbox implementation on Windows blocks access to special device filenames such as "COM1", "COM2", "LPT0", "LPT1", and so on, however i...

CVE-2024-51745

Wasmtime is a fast and secure runtime for WebAssembly. Wasmtime's filesystem sandbox implementation on Windows blocks access to special device filenames such as "COM1", "COM2", "LPT0", "LPT1", and so on, however it did not block access to the special device filenames which use superscript digits,...

CVE-2024-51756 cap-std doesn't fully sandbox all the Windows device filenames

The cap-std project is organized around the eponymous cap-std crate, and develops libraries to make it easy to write capability-based code. cap-std's filesystem sandbox implementation on Windows blocks access to special device filenames such as "COM1", "COM2", "LPT0", "LPT1", and so on, however i...

CVE-2024-51756 cap-std doesn't fully sandbox all the Windows device filenames

The cap-std project is organized around the eponymous cap-std crate, and develops libraries to make it easy to write capability-based code. cap-std's filesystem sandbox implementation on Windows blocks access to special device filenames such as "COM1", "COM2", "LPT0", "LPT1", and so on, however i...

CVE-2024-51756

The CVE affects cap-std’s Windows filesystem sandbox, where access to special device filenames with superscript digits (e.g., COM¹, LPT⁰) was not blocked, allowing untrusted paths to bypass the sandbox and reach peripheral devices or network-shared resources mapped to those devices. Root cause: t...

CVE-2024-51745 Wasmtime doesn't fully sandbox all the Windows device filenames

Wasmtime is a fast and secure runtime for WebAssembly. Wasmtime's filesystem sandbox implementation on Windows blocks access to special device filenames such as "COM1", "COM2", "LPT0", "LPT1", and so on, however it did not block access to the special device filenames which use superscript digits,...

CVE-2024-51745

Wasmtime on Windows had a sandbox bypass where filenames with superscript digits (e.g., COM¹, LPT⁰) were not blocked, allowing untrusted Wasm code with filesystem access to reach devices and peripherals via special device filenames. Affected software: Wasmtime’s Windows filesystem sandbox. Root c...

CVE-2024-51745 Wasmtime doesn't fully sandbox all the Windows device filenames

Wasmtime is a fast and secure runtime for WebAssembly. Wasmtime's filesystem sandbox implementation on Windows blocks access to special device filenames such as "COM1", "COM2", "LPT0", "LPT1", and so on, however it did not block access to the special device filenames which use superscript digits,...

CVE-2024-51745 Wasmtime doesn't fully sandbox all the Windows device filenames

Wasmtime is a fast and secure runtime for WebAssembly. Wasmtime's filesystem sandbox implementation on Windows blocks access to special device filenames such as "COM1", "COM2", "LPT0", "LPT1", and so on, however it did not block access to the special device filenames which use superscript digits,...

CVE-2024-50333

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. User input is not validated and is written to the filesystem. The ParserLabel::addLabels function can be used to write attacker-controlled data into the custom language file that will be includ...

CVE-2024-50333 RCE in ModuleBuilder in SuiteCRM

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. User input is not validated and is written to the filesystem. The ParserLabel::addLabels function can be used to write attacker-controlled data into the custom language file that will be includ...

CVE-2024-50333

CVE-2024-50333 pertains to SuiteCRM where user input is not validated and is written to the filesystem. The issue arises from ParserLabel::addLabels(), which can write attacker-controlled data into a custom language file that is included at runtime. Affects SuiteCRM versions prior to 7.14.6 and 8...

CVE-2024-50333 RCE in ModuleBuilder in SuiteCRM

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. User input is not validated and is written to the filesystem. The ParserLabel::addLabels function can be used to write attacker-controlled data into the custom language file that will be includ...

AZL-52492 CVE-2024-50116 affecting package kernel for versions less than 5.15.173.1-1

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix kernel bug due to missing clearing of buffer delay flag Syzbot reported that after nilfs2 reads a corrupted file system image and degrades to read-only, the BUGON check for the buffer delay flag in submitbhwbc may fai...